Are Cookie Banners Required in the US: State Laws and GDPR

No federal law requires cookie banners on U.S. websites, so whether cookie banners are required in the US depends on which state privacy laws apply to your business and whether you serve visitors in Europe. Roughly 20 state privacy statutes now regulate what websites can do with data collected through cookies, and California alone sweeps in any business with more than $26,625,000 in annual revenue or data on 100,000 or more state residents.¹ Add the EU’s GDPR, which reaches any site offering goods or services to people in Europe, and most commercial sites end up needing a cookie notice, an opt-out link, or a full consent banner even without a federal mandate.

The Federal Picture Is Narrow

There is no comprehensive federal privacy statute that tells websites to display a cookie banner. Two federal rules do reach cookie-based tracking in specific situations.

The Children’s Online Privacy Protection Act (COPPA) requires websites directed at children under 13, or sites that know they collect data from children, to obtain verifiable parental consent before gathering personal information. Persistent identifiers set through cookies fall inside that rule.² If your site targets kids or you have reason to know children use it, COPPA applies regardless of the state you operate from.

The Federal Trade Commission has also taken a hard line on health-related tracking. In a joint warning with HHS, the FTC told hospitals, telehealth providers, and other health-related sites that tracking pixels or analytics tools sending identifiable health data to third parties can violate the FTC Act and trigger the Health Breach Notification Rule, even for companies outside HIPAA’s reach.³ Any site handling health information should treat undisclosed analytics cookies as a real federal risk.

Where State Privacy Laws Take Over

About 20 states have comprehensive privacy laws, and they follow a common pattern. Cookies and similar trackers are treated as tools that collect personal information. Most states use an opt-out model for ordinary data, meaning you can set cookies by default but must give visitors a way to say no. For sensitive data, most states flip to opt-in, meaning affirmative consent must come first.

Sensitive data typically includes biometric identifiers, precise geolocation, health information, data revealing race or ethnicity, religious beliefs, sexual orientation, and children’s personal information. If your cookies or tags touch any of that, you almost certainly need a consent mechanism that gets a clear “yes” before those trackers fire.

California

California has the widest practical reach. The CCPA, as amended by the CPRA, treats data collected through cookies as personal information when it identifies, relates to, or could reasonably be linked to a consumer or household. Browsing history, IP addresses, and data captured by cookies or web beacons all qualify.⁴

California does not require a European-style opt-in banner for most data. Covered businesses must provide a “Do Not Sell or Share My Personal Information” link so visitors can opt out of having their data sold or shared with third parties.⁵ Opt-in applies to minors. A business with actual knowledge that a consumer is under 16 cannot sell or share that consumer’s information unless the consumer (ages 13 to 15) or their parent or guardian (under 13) affirmatively authorizes it.⁶

Virginia, Colorado, and Connecticut

Virginia’s Consumer Data Protection Act uses opt-out for ordinary data and requires consent before processing sensitive data. For data about a known child, the business must comply with COPPA.⁷

Colorado follows the same pattern. Controllers must obtain consent before processing sensitive data, before processing personal data concerning a known child, and before using personal data for a purpose incompatible with what was originally disclosed.⁸

Connecticut’s Data Privacy Act is opt-out for standard data and opt-in for sensitive data, including personal data of children under 13.⁹ Connecticut defines consent strictly: it must be a clear affirmative act that is freely given, specific, informed, and unambiguous. Hovering over content, pausing a video, or closing a pop-up does not count, and neither does burying consent language inside broad terms of use.¹⁰

Utah

Utah is the outlier. Its Consumer Privacy Act does not require opt-in for sensitive data. Instead, a controller must give consumers clear notice and a chance to opt out before processing sensitive data. Children’s data defers to COPPA. Utah also imposes both a $25 million revenue floor and a data-volume threshold, so it covers the narrowest slice of businesses among the major state laws.¹¹

New Laws in 2026

Indiana, Kentucky, and Rhode Island privacy laws took effect January 1, 2026, all largely following Virginia’s framework of opt-out for general data and opt-in for sensitive data. Rhode Island’s thresholds are notably lower than most, covering businesses that process data of at least 35,000 consumers, or just 10,000 consumers if more than 20 percent of revenue comes from selling personal data. Oregon amended its existing law on the same date to prohibit selling personal data when the controller knows or willfully disregards that a consumer is under 16.

Is Your Business Even Covered

You only have to comply with a given state’s law if your business meets that state’s thresholds. The main ones as of 2026:

California: annual gross revenue above $26,625,000; or buying, selling, or sharing personal information of 100,000 or more California residents or households; or deriving 50 percent or more of annual revenue from selling or sharing personal information.¹
Virginia: processing data of at least 100,000 consumers, or 25,000 consumers if more than 50 percent of gross revenue comes from selling personal data.⁷
Colorado: processing data of at least 100,000 consumers, or 25,000 consumers if the business derives any revenue from selling personal data.⁸
Connecticut: processing data of at least 100,000 consumers, or 25,000 consumers if more than 25 percent of gross revenue comes from selling personal data.⁹
Utah: annual revenue of $25 million or more, plus processing data of at least 100,000 consumers, or 25,000 consumers if more than 50 percent of revenue comes from data sales.¹¹

California is the only major state that uses a standalone revenue trigger. A mid-sized e-commerce company doing $27 million in annual sales is covered even if only a small share of its customers live in California. Virginia, Colorado, and Connecticut set no revenue floor at all. They look only at how many consumers’ data you handle.

A Banner Alone May Not Be Enough

Several states now require businesses to honor browser-level opt-out signals, sometimes called Global Privacy Control. Instead of clicking opt out on every website, a visitor can set a signal in the browser that goes out automatically to every site. California already requires covered businesses to treat those signals as valid opt-out requests.⁵ As of January 2026, Colorado, Connecticut, and Oregon are on that list too.

If your site uses advertising or analytics cookies that share data with third parties, you need technology that detects those signals and suppresses the relevant cookies automatically. A banner that visitors can click does not satisfy the law if your site ignores the browser signal saying the visitor has already opted out.

GDPR Is the Reason Most U.S. Sites Have a Banner

Even if no state law applies to your business, the EU’s General Data Protection Regulation and the ePrivacy Directive require opt-in consent before non-essential cookies land on visitors from EU member states. That is affirmative consent before analytics or advertising cookies fire, not just a notice that cookies exist. The GDPR reaches any website that offers goods or services to people in the EU or monitors their behavior, regardless of where the business is based.

That is why cookie banners are so common on U.S. sites. A company with no obligation under California or Virginia law may still need a consent banner because some fraction of its traffic comes from Europe. Penalties under the GDPR run up to 4 percent of global annual revenue or €20 million, whichever is higher. Most commercial sites with any international traffic use a consent tool that detects visitor location and shows a full opt-in banner to EU visitors while displaying the correct opt-out mechanism for visitors covered by U.S. state laws.

What a Compliant Cookie Notice Does

The exact contents depend on which laws apply, but a notice built for the strictest requirements will cover most cases. It should:

State plainly, on arrival, that the site uses cookies and similar tracking technologies.
Group cookies by purpose, such as those needed for the site to function, analytics cookies that measure traffic, and advertising cookies used for targeted ads.
Give visitors a way to decline non-essential cookies. For California, include the required “Do Not Sell or Share My Personal Information” link.
Withhold sensitive-data cookies and cookies aimed at minors until the visitor affirmatively agrees.
Link prominently to a full privacy policy covering collection, sharing, retention, and how to exercise rights.

How the Banner Itself Can Create Liability

California’s regulations prohibit cookie banners and consent interfaces that use dark patterns to push visitors toward less privacy-protective choices. The rules require “symmetry in choice,” so the path to opt out cannot be longer, harder, or more confusing than the path to accept tracking.¹²

A banner that displays a prominent “Accept All” button while burying “Decline” behind multiple clicks creates real regulatory risk. The California Privacy Protection Agency has flagged specific examples: an opt-out that takes more steps than opting back in, an opt-in screen offering only “Yes” and “Ask Me Later” without a clear “No,” and consent interfaces that use confusing or misleading language.¹² Connecticut’s law similarly provides that agreement obtained through dark patterns does not count as valid consent.¹⁰

What Non-Compliance Costs

State attorneys general, and in California the California Privacy Protection Agency, enforce these laws. Financial exposure is per violation, so a site serving millions of visitors can accumulate liability quickly.

California’s penalties were adjusted for inflation effective January 1, 2025, and remain in effect through 2026. Each unintentional violation carries a fine of up to $2,663. Intentional violations, and violations involving data from consumers known to be under 16, carry fines up to $7,988 per violation. California also gives consumers a private right of action for certain data breaches, with statutory damages between $107 and $799 per consumer per incident, or actual damages if higher.¹

Virginia allows the attorney general to seek civil penalties of up to $7,500 per violation after a 30-day cure period.¹³ Colorado treats violations as deceptive trade practices, with penalties up to $20,000 per violation, assessed separately for each consumer or transaction involved.¹⁴

Several states initially gave businesses a grace period to fix violations before facing penalties. Those cure periods are sunsetting. In 2026, cure periods expire or have already expired in Connecticut, Delaware, Kentucky, Minnesota, and Montana. Once a cure period sunsets, the attorney general can pursue penalties immediately, without giving the business a chance to fix the problem first.

1
California Privacy Protection Agency. Updated Monetary Thresholds in CCPA
2
Federal Trade Commission. Complying with COPPA Frequently Asked Questions
3
Federal Trade Commission. FTC and HHS Warn Hospital Systems and Telehealth Providers About Privacy and Security Risks From Online Tracking Technologies
4
California Privacy Protection Agency. What Is Personal Information
5
State of California – Department of Justice – Office of the Attorney General. California Consumer Privacy Act (CCPA)
6
California Legislative Information. California Civil Code 1798.120 – Consumers Right to Opt-Out of Sale or Sharing
7
Virginia Code Commission. Virginia Code Title 59.1 – Consumer Data Protection Act
8
Colorado General Assembly. SB21-190 – Protect Personal Data Privacy
9
Office of the Attorney General. The Connecticut Data Privacy Act
10
Connecticut General Assembly. Public Act No. 22-15 – An Act Concerning Personal Data Privacy and Online Monitoring
11
Utah Legislature. Utah Consumer Privacy Act Chapter 61
12
California Privacy Protection Agency. Enforcement Advisory No. 2024-02
13
Virginia Office of the Attorney General. Virginia Consumer Data Protection Act Summary
14
Justia. Colorado Code 6-1-112 – Civil Penalties – Definition